experience-lwc-accessibility-jest-run
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates shell command templates for running tests using
bazelandnpm. These commands are configured with environment variables (e.g.,SA11Y_AUTO=1) and flags (e.g.,--test_output=streamed) necessary for accessibility testing within Salesforce environments. Evidence is found inreferences/running-sa11y-jest-tests.mdwhich provides templates for single-file, module, and integration testing. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest component names, module names, and file paths from the user prompt to dynamically construct test targets.
- Ingestion points: Component and module identifiers provided in the user prompt to populate
{moduleName}and{relativePath}placeholders. - Boundary markers: The skill includes environment detection logic (checking for the presence of a
WORKSPACEfile) to differentiate between core build and standalone execution modes, providing context boundaries for the generated commands. - Capability inventory: The skill uses the
npmtool (as declared in theallowed-toolsfrontmatter) and generates shell strings forbazel testandnpm testexecution. - Sanitization: Instructions provide strict command templates and specific file-naming conventions (e.g., dropping the
.test.jsextension) which constrain the input and minimize the risk of arbitrary command injection.
Audit Metadata